AADSTS65001: The user or admin has not consented to use the application

AADSTS65001: The user or admin has not consented to use the application

TL;DR

Your app asks for permissions that need consent nobody has granted yet. Low-risk permissions can be consented by the user at login, but privileged ones need a tenant admin's explicit grant. Find which permission requires admin consent in the app registration, have an admin grant it (or send them the admin consent URL), and re-test with a regular user.

AADSTS65001: The user or admin has not consented to use the application

Use this when

• Users hit this error at Microsoft login instead of reaching your app
• You just added new API permissions to the registration
• It works for admins but fails for regular users
• A customer tenant blocks your multi-tenant app at first login

Not for this skill when

• The error is AADSTS50011 about reply URLs (different problem)
• The client secret expired (that fails later, at the token endpoint)
• Conditional access blocks the user (that names the policy, not consent)

Steps

1. Identify the permission demanding consent. In Entra ID, open the app registration, then API permissions. Look for permissions marked as requiring admin consent, and for any recently added ones still showing "not granted". Expected: you can name the exact permission (for example, a mail-read or directory-read scope) that is ungranted.

2. Have a tenant admin grant it. An admin opens the same API permissions page and clicks Grant admin consent. The status flips to granted for the whole tenant. Expected: the permission row shows granted, and the consent prompt disappears for users.

3. If you are not the admin, send the admin consent request properly. Many tenants have an admin consent workflow where users can request approval from inside the login flow. Alternatively, direct the admin to the admin consent endpoint for your tenant and client ID so they can review and approve in one step. Expected: the admin completes the grant instead of the request dying in email.

4. Re-test with a non-admin user. Admins sometimes bypass consent prompts, so only a regular user proves the fix. Expected: login completes with no consent error.

Variant: user consent disabled tenant-wide

Some tenants turn off user consent entirely, so even low-risk permissions need an admin. In those tenants every new permission on your app means another admin grant. Plan for it in your rollout docs.

Variant: "Need admin approval" screen instead of an error code

Same underlying state, friendlier wording. The user-facing screen offers to request approval. The fix is identical: an admin grants consent.

Variant: consent granted, then broken again later

You added another privileged permission after the grant. Admin consent covers only the permissions granted at the time. Each new privileged permission needs its own grant.

Variant: incremental consent in MSAL

Apps using MSAL can request additional scopes at runtime. Each newly requested privileged scope can trigger this error for users until an admin consents. Batch your scope requests to reduce the trips.

Why this happens

Consent is the tenant's authorization for your app to act with the user's permissions. Privileged scopes (reading other users' mail, directory data) are powerful enough that Microsoft requires a tenant admin, not just the individual user, to approve them. Without that grant, the login stops at the consent wall by design.

Edge cases and pitfalls

• Personal Microsoft accounts and work accounts consent differently. Test with the account type your users actually have.
• In multi-tenant apps, each customer tenant needs its own admin grant. Your home tenant being fine tells you nothing about theirs.
• Removing a permission from the registration does not always clear the consent requirement immediately. Verify in the portal rather than assuming.
• Asking for privileged scopes you do not need creates consent friction and security review pain. Request the minimum scopes that do the job.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_9I6XoKfEODdMnJbNmmm6XQ